[WAF-07] Implement scalar transaction variables

Objective

Implement request, response, connection, server, timing, body-error, severity, matched-value, identity, and compatibility scalar variables with correct phase availability and origins.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-06

Blocks

• WAF-08
• WAF-23

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

Implementation slice merged to main in e5b98cbfe41190d008d5fa6e2d30d9ccdc650b66 (feat(engine): add bounded scalar variables). It adds transaction-owned small-value storage with heap fallback, aggregate/per-value limits, origin metadata, phase availability, case-insensitive SecLang lookup, connection/request-target/query/body-length/response/identity/match/severity foundations, lifecycle wiring, allocator leak coverage, compatibility-matrix evidence, and C ABI limit-error mapping. Local native tests, C smoke tests, Linux cross-compilation, formatting, and hosted CI pass: https://github.com/zig-utils/zig-waf/actions/runs/29896431208. The issue remains open for the rest of the stable scalar union and differential fixtures.

Dependency update: WAF-06 is complete and closed with five-phase numbering, phase legality, early-exit/termination semantics, detection-only behavior, exactly-once logging finalization, C ABI evidence, and a hosted ReleaseFast lifecycle benchmark: /zig-utils/zig-waf/issues/7. WAF-07 is now unblocked; its existing bounded scalar foundation can be completed against a stable lifecycle contract.

Progress: pushed ff5cbfa (feat(engine): define stable scalar variable union) directly to main.

This replaces the incomplete registry with the 81-name ModSecurity 3.0.16 / Coraza 3.7.0 stable scalar union, records minimum phase availability and origins, preserves the historical MULTIPART_SEMICOLON_MISSING alias, rejects the nonstandard RESPONSE_BODY_LENGTH, and adds exhaustive case-insensitive round-trip/uniqueness tests.

Next: transaction producers, timing, body-error, identity, response, and match semantics.

Progress: pushed 45986e0 (feat(engine): populate scalar transaction state) directly to main.

Implemented bounded producers and phase gating for connection/server/request/response, header-derived auth and body processors, identity, request/response body diagnostics, compatibility/error flags, stable RESPONSE_CONTENT_LENGTH, generated unique IDs, minimum-severity tracking, and matched-value state. Timing now uses wall + monotonic clocks through Zig 0.17 std.Io, with an explicit nonblocking/thread-safe injectable clock contract and deterministic tests. Header state updates are failure-atomic after validation.

Focused zig build test and zig build check passed before push.

Completed on main.

Final commits:

• ff5cbfa — stable scalar registry (correction: the canonical scoped union is 77, not 81 as stated in my first progress comment)
• 45986e0 — transaction producers, clocks, origins, phase gates, error and match semantics
• 9b25a44 — cache-friendlier 64-byte inline layout, exhaustive count correction, ReleaseFast benchmark and CI gate
• b59955e — compatibility matrix and normative contracts

Evidence:

• 22 unit/integration tests plus C ABI smoke pass with pinned Zig 0.17.0-dev.1441+d5181a9c9.
• Hosted CI is green: https://github.com/zig-utils/zig-waf/actions/runs/29934058906
• Local ReleaseFast evidence: transaction size 7,536 bytes; populated scalar lifecycle ~5.18 us/transaction on this host. This is a tracking benchmark, not the WAF-39 baseline claim.
• RESPONSE_CONTENT_LENGTH replaces the nonstandard prior spelling; the historical multipart semicolon alias remains accepted.
• Collection-derived aggregates remain explicitly owned by WAF-08; opt-in full body materialization remains WAF-24/WAF-28. Neither silently substitutes values.

During qualification, the project Pantry shim was found to target a zero-byte local Zig artifact. I rejected those false-positive invocations, reran all checks with the intact exact Pantry-pinned global compiler, and tracked the Pantry repair at /pantry-pm/pantry/issues/217.